Publish Forum topic Publish your post to the cyberwarzone forum for free and no registration!

SCADA password list for recovery of lost SCADA passwords

Download the most complete SCADA password list directly from Cyberwarzone. In this SCADA password list we have collected various online resources that contain SCADA passwords.

The SCADA systems that have been mentioned in the list all use default SCADA passwords. You can use this list to recover lost SCADA systems passwords.

The following vendors have been included:

  • ABB
  • B&B Electronics
  • Digi, Emerson
  • eWON, Hirschmann
  • Moxa, Netcomm Wireless
  • Rockwell Automation
  • Samsung
  • Schneider Electric
  • Siemens
  • Yokogawa.
SCADA stands for Supervisory Control And Data Acquisition

SCADA PASSWORD LIST

 

Yokogawa CENTUM CS 3000 DCS CENTUM:CENTUM
Yokogawa EJX910A Multivariable Transmitter HART Communication Type YOKOGAWA. (to release the Write Protect mode),
Yokogawa WT 3000 Driver anonymous:blank (Ethernet access)
Yokogawa DX1000/DX1000N/DX2000 Advanced Administrator 1:Admin1, Administrator 2:Admin2, …, Administrator 5:Admin5, User 1:User01, …, User 90:User90
Yokogawa YFGW410 gateway admin:!admin
Wonderware System Platform/Archestra administrator:blank
Wonderware Intouch Administrator:Wonderware
Wonderware Historian SQL Server Login: aadbo:pwddbo, wwdbo:pwddbo, aaAdmin:pwAdmin, wwAdmin:wwAdmin, aaPower:pwPower, wwPower:wwPower, aaUser:pwUser, wwUser:wwUser
Westermo TDW 33 no password, just return, Hardcoded password: n3Y9kA6otYZu8, (?? TD-36)
Westermo MRD-305-DIN/MRD-310/MRD-315/MRD-330/MRD-355/MRD-350/MRD-455 admin:westermo
Westermo RedFox Series, Wolverine Series, Lynx Series, Falcon Series, Viper Series admin:westermo
Wellintech KingSCADA 3.0 administrator:administrator (role KVAdministrator)
Wago WAGO-I/O-IPC 758-870/000-xxx http, ftp:, user:user00 , administrator:, su:ko2003wa
Wago WAGO-I/O-SYSTEM 750 admin:wago, user:user, guest:guest
Wago Modular I/O-System Linux Fieldbus Coupler 750-860 root:wago , admin:wago, user:user , guest:guest
Turck BL20-E-GW-EN, BL67-E-GW-EN HTTP: password, FTP: (unspecified hardcoded)
Tridium NiagaraAX tridium:niagara
Tecomat Tecomat Foxtrot 0:0 (role 0) , 1:1 (role 1), 2:2 (role 2), 3:3 (role 3), 4:4 (role 4), 5:5 (role 5), 6:6 (role 6), 7:7 (role 7), 8:8 (role 8), 9:9 (role 9)
TAC AB TAC Xenta 500/700/911/913, TAC Xenta 511, TAC Xenta 527, root:root
Stulz GmbH Stulz WIB 8000 Administrator, highest authorization:, ganymed, Medium authorization:, kallisto, Lowest authorization:, europa
Sierra Wireless AirLink sconsole:12345
Sierra Wireless AirLink user:12345, viewer:12345
Siemens RUGGEDCOM ROX II for RX1500, RX1501, RX1510, RX1511, RX1512 root:admin (service), admin:admin (administrator), oper:oper (operator), guest:guest (guest)
Siemens Siemens WinCC 7.x winccd:winccpass, wincce:winccpass, DMUser:Data&Pass, Administrator:Administrator
Siemens Ruggedcom RMC30 admin:admin, operator:operator, guest:guest
Siemens RuggedSwitch RS8000 / RS1600 / RS900 admin
Siemens Scalance X-200, W788-1PRO, W788-2PRO, etc. admin:admin (HTTP), user:user (HTTP), siemens:siemens (FTP)
Siemens Siemens ST950 root:zP2wxY4uE
Siemens Simatic S7-300 (pre-2009 versions) Hardcoded password: Basisk:Basisk
Siemens S7-1200 / S7-1500 admin:blank
Siemens Siemens Climatix Level 6 End users: 1000 (Physical), Level 4 Service operator: 2000 (Physical), Level 2 OEM: 6000 (Physical), Web: ADMIN:SBTAdmin!
Siemens Sicam SGU 642935177
Siemens Sicam SGU [email protected]:charleM!800
Siemens Synco living Web server OZW772 V2.0 Administrator:Password
Schneider Electric PowerLogic ION7550 / ION7650 / ION8650 Energy and power meter 0
Schneider Electric Quantum NOE 771 xx FTP and HTTP Service: USER:USER
Schneider Electric POWERLOGIC EGX200 / EGX400 with firmware version 5.5 or higher Administrator:admin, User 1:master, User 2:engineer, User 3:operator
Schneider Electric PowerLogic Ethernet Gateway EGX300 / EGX100 Administrator:Gateway
Schneider Electric PowerLogic Series 800 Power Meter 0
Schneider Electric Modicon Quantum ftpuser/password, qbf77101/hexakisoctahedron, USER:USER
Schneider Electric Modicon M340 for Ethernet ntpupdate:ntpupdate (Using an FTP client, store your rules in the file:, /FLASH0/wwwroot/conf/NTP/customrules), USER:USER (FTP Setup page via HTTP, HTTP credentials), sysdiag:[email protected] (FTP)
Schneider Electric Modicon Premium FTP: sysdiag:[email protected], HTTP: USER:USER
Schneider Electric PM8000, PM8240, PM8243, PM8244 Physical: 0, FTP: 8000:<display password>
Schneider Electric TSX ETG 1000 HTTP Server, PAP Protocol: USER:USER, FTP: wsupgrade:wsupgrade, Serial Connection: Administrator:Gateway
Schneider Electric ETG100 Administrator:Gateway
Schneider Electric M258 adm:adm
Samsung Integrated Management System DMS root:rkwjsdusrnth
Samsung Integrated Management System S-NET mini DMS Connection: 0000 or 1234
SAMSON GROUP TROVIS 5590 Web Module To read data 1111:1111, To change data 4444:4444
Rockwell Automation / Allen-Bradley 1734-AENT admin:password
Rockwell Automation / Allen-Bradley 1756-EN2TSC Administrator:admin
Rockwell Automation / Allen-Bradley 9300-RADES HTTP: blank:ZYPCOM, Telnet: blank:ZYPCOM, FTP: uploader:ZYPCOM, CHAP/PAP: ppp_user:ZYPCOM
Rockwell Automation / Allen-Bradley 9300-8EDM HTTP: blank:ZYPCOM, Telnet: blank:ZYPCOM, FTP: uploader:ZYPCOM
Rockwell Automation / Allen-Bradley PanelView Plus 6 Graphic Terminals, Firmware 6.10 or later/, PVPlus 6 password
Rockwell Automation / Allen-Bradley MicroLogix 1400 / MicroLogix 1100 Embedded Web Server guest:guest, administrator:ml1400 (MicroLogix 1400), administrator:ml1100 (MicroLogix 1100)
Rockwell Automation / Allen-Bradley 1756-EWEB, 1768-EWEB Administrator:<none>
Prosoft Technology ICX30-HWC admin:password
Phoenix Contact Logic+ admin:admin
Phasefale Controls JouleTemp admin:pass
Ouman EH-net server admin:admin
Omron IA CJ1M CPU Units with Ethernet Functions for http: ETHERNET, for ftp: CONFIDENTIAL
Omron NS-Series Programmable Terminals Web Interface (NS12-TS01-V2, NS10-TV01-V2, NS8-TV01-V2, NS5-SQ11-V2, NS5-TQ11-V2 and NS5-MQ11-V2) default:default
NOVUS AUTOMATION SuperView superview:superview
Netcomm Wireless 3G21WB (BigPond Firmware), 3G9WB (BigPond Firmware), N3G001W (Netcomm Firmware), NB14WN (Netcomm Firmware), NB5 (Netcomm Firmware), NB5Plus4 (Netcomm Firmware), NB6Plus4 (Netcomm Firmware), NB6Plus4W (Netcomm Firmware), NNB7 (Netcomm Firmware), NB9WMAXX (Netcomm Firmware), NP804N (Netcomm Firmware) admin:admin
Netcomm Wireless NB1300 Plus 4 (Netcomm Firmware), NP803N (Netcomm Firmware) admin:password
Moxa OnCell G3100 Series HTTP admin:admin, HTTP Admin:Keep <blank>, PAP admin:<blank>
Moxa IA240/241 Embedded computer telnet root:root, FTP root:blank, PPP root:root, serial console root:root
Moxa AirWorks AWK-3131-RCC admin:root
Moxa VPort 461 Industrial Video Encoder admin:admin, <none>:<none>
Moxa Cellular Micro RTU Controller (ioLogik W53xx, ioLogik) administrator:blank, Telnet on port 9900 / 9000: root:root
Moxa Railway Remote I/O (ioLogik E12xx, ioLogik E15xx) HTTP on Port 9020: 1)none:root, 2)none:none
Moxa OnCell Central Manager admin:admin
Moxa EDS-508A/505A Series admin:<none>
Mitsubishi PLC QnUCPU QnUDVCPU MELSEC:MELSEC
Mitsubishi PLC QnUCPU QnUDE(H)CPU QNUDECPU:QNUDECPU
Kostal Solar PIKO-Inverter 3.0, 3.6, 4.2, 5.5, 7.0, 8.3, 10.1 pvserver:pvwr
IBM 2210 def:trade
HollySys Automation Technologies LK SERIES PLC FTP blank, Telnet blank
Hirschmann RSP 20/25/30/35 user:public, admin:private
Hirschmann MACH 4000 Family/MACH 1000 Family/MACH 100 Family/MACH 4002 Family/MACH104 Family Full Gigabit/MACH 1040 Family Full Gigabit user:public, admin:private
Hirschmann OCTOPUS 8M…, OCTOPUS 16M…, OCTOPUS 24M… user:public, admin:private
Hirschmann RS20/RS30, MICE user:public, admin:private
Helmholz Systeme NETLink PRO HW 1-1a-1 and FW 1. 54 and higher NETLink PRO PoE:admin
General Electric Intelligent Platforms IC695ETM001, IC695CPE305, IC695CPE310, IC695CPE330, IC698ETM001, IC698CPE010, IC698CPE020, IC698CRE020, IC698CPE030, IC698CPE040, IC698CRE030, IC698CRE040 system
General Electric Intelligent Platforms IC695ECM850 admin:system
General Electric Intelligent Platforms IC695PNC001 admin:system
General Electric Intelligent Platforms IC698CPE030, IC698CPE040, IC698CRE030, IC698CRE040 user:system
eWON all adm:adm
ENTES EMG-10, EMG-02 , EMG-12 emg12 (for EMG12), emg10 (for EMG10), emg02 (for EMG02)
Endress+Hauser Fieldgate FXA520 super:super
Emerson DeltaV Digital Automation System Administrator:deltav
Emerson Avocent ACS 6000 Advanced Console Server admin:avocent, root:linux
Emerson Control Link Refrigeration System Controller 0
Emerson ControlWave Micro Quick for download project:, SYSTEM:666666
Emerson Network Power MPH2 Rack PDU admin:admin
Emerson UltraSite User 01:100, User 05:200, User 09:300, Engineer:400
Emerson ROCLINK 800 LOI:1000
Emerson IP-KVM Avocent MergePoint Unity Admin:blank
Emerson Ovation DCS wdpf
Emerson Ovation DCS SNMP community string: wdpfRO
Emerson UL33 UPS 123456
Emerson Liebert IntelliSlot Web Card Liebert:Liebert, User:User
Emerson Smart Wireless Gateway 1420 admin:default, maint:default, oper:default, exec:default
Electro Industries/GaugeTech Communicator EXT 3.0 eignet:inp100
Electro Industries/GaugeTech Nexus 1500+, Nexus 1500 anonymous:anonymous
Echelon i.LON SmartServer for ftp and lns servers:, ilon:ilon
Digi Digi Connect ES 4/8 SB with Switch, Digi Connect ES 4/8 SB root:dbps
Digi DigiOne IAP Serial root:dbps
Digi Digi Connect WAN, Digi Connect WAN GPRS, Digi Connect WAN GSM-R, Digi Connect WAN VPN, Digi Connect WAN IA, Digi Connect WAN 3G, Digi Connect WAN 3G IA, Digi Connect WAN 4G root:dbps
Digi Digi TransPort WR21/WR44 username:password
Digi Digi CM root:dbps
Digi Digi Connect SP,Digi Connect Wi-SP,Digi Connect ME,Digi Connect ME 4 MB,Digi Connect Wi-ME,Digi Connect EM,Digi Connect Wi-EM root:dbps
Digi DC-ME-01T-S root:dbps
Digi ConnectPort TS 4×4, ConnectPort TS 4×2, ConnectPort TS W, ConnectPort TS 8, ConnectPort TS 8 MEI, ConnectPort TS 16 root:dbps
Deif AWC 500 root:deif7800 (administrator), default:1234 (user)
Datasensor UR5i/UR5i SL root:root
Contemporary Control Systems BASRT-B admin:admin
Carlo Gavazzi PowerSoft admin:admin, user:user
BinTec Elmeg BinTec X1200 II admin:bintec,
BinTec Elmeg any routers (##unknown – means not known or any char):, ##unknown:snmp-Trap , suggested:, admin:1234, admin:password, admin:admin
BinTec Elmeg BinTec R230aw admin:funkwerk
BinTec Elmeg Bintec W2002T-n admin:funkwerk, admin:admin
Beckhoff Automation GmbH CX5020 webguest:1
Beck IPC [email protected] PPPSERVER:, ppps:ppps
B&B ELECTRONICS CR10 v2 root:root
B&B ELECTRONICS Conel 4.0.1 root:root
B&B ELECTRONICS ER75i/ER 75i DUO/ER 75i SL/ER75i v2 root:root
B&B ELECTRONICS LR77 v2 Libratum/LR77 v2 root:root
B&B ELECTRONICS UR5i v2 root:root
B&B ELECTRONICS UCR11-v2/UCR11 v2 SL root:root
B&B ELECTRONICS XR5i v2E/XR5i v2/XR5i/XR5i SL root:root
B&B ELECTRONICS SPECTRE Router root:root
Allied Telesis IE200 Series: AT-IE200-6GT, AT-IE200-6GP, AT-IE200-6FT, AT-IE200-6FP manager:friend
Advantech Advantech WebAccess browser-based HMI and SCADA software admin:blank
Adcon Telemetry Telemetry Gateway A840 and Wireless Modem A440 root:840sw
Adcon Telemetry addVANTAGE Pro 6.1 root:root
ABB AC 800M service:ABB800xA
ABB SREA-01 admin:admin

Please spread the word :)

  • RSS
  • Follow by Email
  • Facebook
  • Google+
    http://cyberwarzone.com/scada-default-password-list-recovery-lost-scada-passwords/">